support https

[line-o]

Currently, only http protocol is supported.
To enable db instances that are only available through https, a few changes have to be made.

Switch to xmlrpc.createSecureClient if https is needed.

node-exist/components/connection.js

Line 17 in 0b8ef3e

var client = xmlrpc.createClient(assign({}, defaultRPCoptions, options))

It is yet not decided on how to trigger switching to https.

Idea:

const ex = require('@existdb/node-exist')

ex.connect({
    'secure': true
})

[duncdrum]

the property makes sense. Design wise i d say https by default would be a good idea, with http as a fallback, but that is also more work.

[line-o]

@duncdrum not really just a different default. The issue is more with local instances not having valid certs which would make the tool fail by default.

[line-o]

Setting this to https by default for security while also defaulting to trust bad certs for convenience is far worse, in my opinion.

[duncdrum]

we're on the same page with not trusting bad certs, I meant try https if that fails due to bad cert, port closed, whatever, fallback to http. The goal being to use https whenever its available.

But a fallback might also hide the fact that folks are using http, meh i m torn 🤷‍♂

[line-o]

@duncdrum revisiting this issue: what about to switch from secure: false to secure: true and documenting it that for local development you need to specify secure: false explicitly?

[line-o]

This turns out to be a breaking change for the "normal" developer setup:

The options now need to change to include either

• { secure: false, port: 8080 } to continue using http
• { rejectUnauthorized: false } for the usual existdb that comes with an expired cert OOTB